•Apprbved For 

Or-T!CF£ OF MANAGEMENT AND B 

oA-re: October 2 , 1975 

HEPUYTO 
ATTN OF: ISD 

SUBJECT: 0MB Circular No. A-108 Transmittal Memorandura No. 1 


. Agency Liaison Representahives for Privacy Act Implementation 

Attached for your information is an advance copy of 
Transmittal Memorandum No-- 1 to 0MB Circular No. A-108 
which establishes the new system reporting requirements 
pursuant to Section 552a (o) of the Privacy Act. 

This Transmittal Memo will be published in the Federal 
Register within the next few days. 



Walter W. Haase 
Deputy Associate Director 
for Information Systems 

Attachment 
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EXECUTIVE OFFICE OF THE PRESIDENT 
OFFICE OF MANAGEMENT AND BUDGET 

WASHINGTON, D.C. ?.0503 


Septexnber 30 j, 197 5 


CIRCULAR NO, A- 108 
Transmittal Memorandom No. 1 


TO THE MEADS OF EXECUTIVE DEPARTMENTS AND ESTABLISHMENTS 


SUBJECT: Responsibilities for the maintenance of records 

about individuals by Federal agencies 


1. Purpose. This supplement to 0MB Circular A- 1 08 dated 
July 1 , 1975 provides guidance to Federal agencies regarding 
the preparation and submission of reports of their intention 
to establish or alter systems of personal records as 
required by the Privacy Act of 1974 (P.L. 93-579, 5 U.S.C. 
552a (o)). These procedures supersede preliminary guidcince 
on preparing the Report on New Systems contained in the 0MB 
Privacy Act Guidelines dated July 1, 1975 (Federal Register, 
July 9, 1975, p, 28977) . 

2. Reporting requirements . 

a. A Report on New Systems raust be submitted when : 

( ^ b. system of personal records su b j ect to the 
Privacy Act is proposed . A new system of records subject to 
the new system reporting requirement is one for which no 
public notice consistent v;ith the provisions of subsection 
(e) (4) is currently published in the Federal Register . 

If a public notice fo.r any specific system of records is 
V7ithdrawn, suspended, cancelled, or terminated and 
subsequently reinstated, the subject system of records shall 
be considered a new system and subject to the new system 
reporting requirement at such time that it is reinstated. 

(2) A change to a system of personal ■ records 
subject to the Privacy Act is proposed . A nev; system report 
is required for any change to ah existing system which meets 
any of the following criteria. 
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■ (a) Increase or change tne iunuber or types of 
individuals on whom records are raaintained. Changes 
involving the number {rather than the types) of .individuals 
about whom records are. kept need onl:/ be reported when that 
change significantly alters the character and purpose of the 
.system of records , e.g,, normal increases in historical 

files or other increases in the nximber of records in a file- 
which can be attributed to normal growth patterns need not 
be reported- A change, resulting from a change in the scope 
of the population covered; e.g., a system which only covered 
a portion of the work force is expanded to cover all, is 
required to be reported. 

(b) Expand the type or categories of 
information maintained. For example, if an employee payroll 
file is expanded to include data on education and training, 
this would be considered an expansion of the "type or 
categories of information" maintained, and would have to be 
reported. 

(c) Alter the manner in which the records are 
organized or the- manner in which the records are indexed or 
retrieved so as to change the nature or scope of those 
records. For example, the combining of two or more existing 
systems or splitting an existing system into tv70 or more 
different systems such as might occur in a centralization or 
decentralization of organizational . responsibilities, would 
require a report- 

(d) Alter the purposes for which the 
information is used. For example, a proposal that files 
currently used as historical military service records are fco 
be used for making determinations on eligibility for 
disability benefits- would require a report. A proposal to 
establish or change the "routine uses" of the system v/ill 
not require the submission of a Report on New System if such 
use is compatible with the purposes for which the system- is 
maintained; i.e., does not, in effect, create a new purpose- 
Any new or changed "routine use" would, however, be subject 
to the requirements to give 30 days prior notice of such 
change in the Federal Register (5 U.S.C. 552a (e) (1 1 ) ) - 

(e) Change the equipme.nt configuration (i.e., 
hardware and/or software) on which the system is operated so 
as to create the potential for either greater or easier 
access. For example, the addition of a telecommunications 
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capability Vv’hich could iucreasa the risk of unauthorised 
access would require a report. 

b. C ontent ot t he Repor r. . The agsnc;/ report on 
proposed” new systems, or proposal to modify existing systems 
shall consist of a brief narrative description, supporting 
documentation and an update of the inventory of Federal 
personal data systems as outlined below: 

(1) Narrative Statement ~ A brief statement, 
normally not to exceed four pages in length, which: 

describes the purposes of the system of 

records. 

identifies the authority under which the 
system of records is to be maintained. 

provides the agency's evaluation of "the 
probable or potential effect of such proposal on the privacy 
and other personal or property rights of individuals or the 
disclosure of information relating to such individuals and 
its effect on the preservation of the constitutional 
principle of federalism and separation of power," and 

provides a brief description of steps 
taken by the agency to minimize the risk of unauthorized 
access to the system of records including a discussion of 
higher or lower risk altarnatives which v*/era considered for 
meeting, the requirements of the system. A more detailed 
assessment . of , the risks and specific administrative, 
technical, procedural, and physical safeguards established 
shall be available on request. 

The narrative statement should make reference, as 
appropriate, to information in the supporting documentation 
rather than restate such information. 

Where changes to computer installations , communications 
networks, or any other general changes in information 
collection, handling, storage or dissemination are made 
which affect multiple systems of records; a single 
consolidated new system report may be submitted. In such 
cases, the narrative statement should address the overall 
privacy implications of the proposed change, identify all 
systems of records affected by the change and briefly 
describe any unique impacts on any specific system of 
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records. Supporting documentation, as defined in the 
subsequent paragraphs, shall be provided for each system of 
records. 

(2) Supporting Dociamentation - The following shall 
be appended to all new system reports: 

(a) An advance copy o f the new - or revised 
system notice J consistent with the provisions or P p.S.C. 
552a (e) (lyT" which the agency proposes to publish for cha new 
or altered system (s ) . For proposed alterations of existing 
systems the documentation should be provided in tne same 
form as the agency proposes to publish the public notice of 
such changes. If the agency proposes to publish changes in 
the form of a revision to the public notice, a copy of the 
proposed notices of revision should be provided. If the 
agency plans fo supersede the entire existing notice, 
changes from the currently published notice shall be 
highlighted by underlining all new or revised portions. 

,(b) advance copy of any new rules or 
changes to published rules (consistent v;ith the provisions 
of 5 U.S.C. 552a (e) (TT) and (f ) ) which the agency proposes 
to issue for the new or altered system. If no change -to 
existing rules are required for the proposed new or altered 
system, the report shall so state. Proposed changes to 
existing rules shall be provided: in a manner similar- to that 
described for the system notices. “ - 

(c) ^ advance copy of any proposed rules 
s etting forth the reasons why the' system ^ is to be exempted 
?rom any specific provision , (consistent with the provisions 
of 5 U.S.C. 552a{j) or if^ the i agency -head plane to 
invoke any exemptions for the nevr o;r altered systems - j 

(3) Update of Federal Inventory of Personal Data 
Systems - 0M3^ in cooperation wish the National Archives -and 
Records Service is developing a perpetual inventory of all 
systems of records subject to the Act. The detailed plans 
for this inventory are still being developed. It is 
anticipated, however, that agencies will be requested to 
provide a simple report to facilitate maintenance of the 
Federal inventory. This portion of the report on new 
systems is not in effect until such time as further 
instructions are issued. 
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c. B.aport Format , 

{ 1 ) Narrative Statement . No standard format has 
been established for the narrative statement. Agencies 
should present the information requested in the most concise 
fashion possible. 

(2) Supporting Documentation . The format of the 
documentation shall, where applicable', be consistent v/ith 
the publication requirements established by the Office of 
the Federal Register of the General Services Administration, 

Npdate of Federal Inventory of Personal Data 
Systems . Format being developed. 

d. D istribution of Report . Two copies of each new 
systems report shall be submitted to each of the followings 

(1) Speaker of the House. 

(2) President of the Senate. 

(3) The Privacy Protection Study Commission during 
the period of its existence as set forth in Section 5 (g) of 
the Privacy Act. 

(4) Office of Management and Budget. 

e. Timing . A report on a proposed new or altered 
system of records shall be submitted no later than the, 
following dates, whichever is earlier: 

f1) Sixty (60) days before any issuance of data 
collection forms and/or instructionsr or 

(2) Sixty (60) days before any public issuance of a 
Request for Proposal or an Invitation to Bid for computer 
and/or communications systems or services intended to 
support the system of records. 

3. Effective Date . The provisions of this Transmittal 
Memorandum are effective upon issuance. 
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Inquiries . riiquiries- ' concerning this -Transmittal 
Memorandum may be addressed to the Information Systems 
Division, Ofi'rice of Management and Budget, Room '9002, NdOS, 
Washington, D,C. 205 ' 
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